ちなみに、ShikenPASS SCS-C03の一部をクラウドストレージからダウンロードできます：https://drive.google.com/open?id=14UKpx4ePxazpsLztmu3sfDDp0jM3kMZS
このインターネット時代において、社会の発展とともに、コストがより低くて内容が完全な情報が不可欠です。弊社のSCS-C03問題集は他のサイトに比べて、試験の範囲をカバーすることはより広くて、合理的な価格があります。しかしも、品質はもっと高くて一度SCS-C03試験に合格したい客様に対して、我が社のSCS-C03はあなたの最高選択かつ成功のショートカットであると思われます。
| Certification Vendor: | Amazon Web Services (AWS) |
|---|---|
| Exam Name: | AWS Certified Security - Specialty |
| Exam Number: | SCS-C03 |
| Real Exam Qty: | 65 |
| Exam Format: | Multiple Response, Multiple Choice |
| Certificate Validity Period: | 3 years |
| Passing Score: | 720/1000 |
| Exam Price: | $300 USD |
| Related Certifications: | AWS Certified Cloud Practitioner AWS Certified Solutions Architect - Associate |
| Available Languages: | Japanese, English, Spanish (Latin American), Simplified Chinese, Korean |
| Exam Duration: | 170 minutes |
| Sample Questions: | Amazon SCS-C03 Sample Questions |
| Exam Way: | Online proctored (PSI) or in-person testing center (Pearson VUE) |
| Pre Condition: | Recommended: AWS Certified Cloud Practitioner or Associate-level certification, minimum 2 years of hands-on AWS security experience |
| Official Syllabus URL: | https://docs.aws.amazon.com/certificates/security-specialty |
SCS-C03認定試験は専門知識と情報技術を検査する試験で、ShikenPASSが一日早くAmazonのSCS-C03認定試験「AWS Certified Security - Specialty」に合格させるのサイトで試験の前に弊社が提供する訓練練習問題をテストして、短い時間であなたの収穫が大きいです。
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 53
A security engineer discovers that a company's user passwords have no required minimum length. The company uses the following identity providers (IdPs):
- AWS Identity and Access Management (IAM) federated with on-premises
Active Directory
- Amazon Cognito user pools that contain the user database for an AWS
Cloud application
Which combination of actions should the security engineer take to implement a required minimum password length? (Select TWO.)
正解：A、C
解説：
Password policies are enforced at the identity provider where authentication occurs. According to the AWS Certified Security - Specialty Study Guide, when IAM is federated with an external identity provider such as on-premises Active Directory, IAM does not manage or enforce password policies. Instead, password requirements such as minimum length must be enforced directly in Active Directory Group Policy Objects.
Amazon Cognito user pools maintain their own user directory and authentication logic. Cognito provides configurable password policies, including minimum length, complexity, and expiration.
To enforce a minimum password length for application users, the Cognito user pool password policy must be updated.
IAM password policies apply only to IAM users that authenticate directly with IAM and do not affect federated users or Cognito users. SCPs and IAM policies cannot enforce password length requirements.
質問 # 54
A security engineer needs to configure DDoS protection for a Network Load Balancer (NLB) with an Elastic IP address. The security engineer wants to set up an AWS WAF web ACL with a rate-based rule statement to protect the NLB.
The security engineer needs to determine a rate limit that will not block legitimate traffic. The security engineer has configured the rule statement to aggregate based on the source IP address.
How should the security engineer configure the rule to protect the NLB?
正解：B
解説：
AWS WAF rate-based rules are designed to help protect applications and resources fromtraffic floods and application-layer DDoS attacksby tracking the number of requests from individual source IP addresses over a rolling time window. According to the AWS Certified Security - Specialty Official Study Guide and AWS WAF documentation, rate-based rules can be configured with different actions, includingCount,Block, and Allow.
When a security engineer is determining an appropriate rate limit that will not block legitimate traffic, AWS best practices recommend initially configuring the rate-based rule with theCountaction. The Count action allows AWS WAF tomonitor and log requests that exceed the specified rate threshold without actively blocking them. This provides visibility into traffic patterns and enables the security engineer to analyze how the rule would behave in production.
By using the Count action, the security engineer can safely evaluate whether legitimate users would be affected by the chosen rate limit. Once the engineer is confident that the threshold accurately distinguishes between normal traffic and malicious behavior, the action can later be changed to Block.
Option B is incorrect because immediately blocking traffic without validation risks denying service to legitimate users. Option C is invalid because AWS WAF does not have a Monitor action. Option D is incorrect because the Allow action does not enforce rate limiting.
AWS documentation explicitly recommendsstarting rate-based rules in Count modeto fine-tune thresholds before enforcing blocks, especially for DDoS protection scenarios.
* AWS Certified Security - Specialty Official Study Guide
* AWS WAF Developer Guide - Rate-Based Rules
* AWS DDoS Resiliency Best Practices
質問 # 55
A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company's primary website. The GuardDuty finding received read:UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor.
What is the first step the security engineer should take?
正解：D
解説：
The findingInstanceCredentialExfiltrationindicates that credentials available to the EC2 instance (from the instance profile / IMDS) were likely stolen and then used from an unusual location. The fastest way todeny the malicious actor immediatelyis to invalidate the stolen, currently usable credentials. Because these aretemporary credentialsissued to the instance profile role, the correct first containment action is torevoke active sessionsfor that role so the stolen session credentials stop working. This directly blocks continued API use while you continue investigation and remediation.
質問 # 56
A company needs to build a code-signing solution using an AWS KMS asymmetric key and must store immutable evidence of key creation and usage for compliance and audit purposes.
Which solution meets these requirements?
正解：C
解説：
AWS CloudTrail provides authoritative records of KMS key creation, origin, and usage. Enabling log file validation ensures tamper detection. S3 Object Lock in compliance mode enforces immutability, which is a core audit requirement cited in AWS Certified Security - Specialty materials.
CloudWatch and DynamoDB do not provide immutable storage guarantees suitable for compliance evidence.
Referenced AWS Specialty Documents:
AWS Certified Security - Specialty Official Study Guide
AWS CloudTrail Log File Validation
Amazon S3 Object Lock
質問 # 57
A company has a compliance requirement to encrypt all data in transit. The company recently discovered an Amazon Aurora cluster that does not meet this requirement.
How can the company enforce encryption for all connections to the Aurora cluster?
正解：B
解説：
To enforce encryption in transit to Aurora, you must require clients to useTLS/SSLwhen connecting to the database. Aurora (depending on engine flavor) supports a parameter that enforces secure transport by rejecting non-TLS connections. Setting the DB (cluster/instance) parameter such asrequire_secure_transporttoONforces clients to negotiate SSL/TLS; otherwise the server refuses the connection, ensuring all data in transit is encrypted. This directly enforces the compliance requirement at the database endpoint itself, independent of client behavior.
Kerberos authentication (Option B) provides centralized authentication and can be useful for IAM/AD integration, but it does not by itself guarantee that the network session is encrypted. Option C is incorrect because Aurora/RDS usesRDS-provided certificatesfor TLS; you don't attach ACM certificates to Aurora the way you would for ALB/CloudFront. Option D is not the right enforcement mechanism: RDS Proxy can help with connection pooling and IAM auth patterns, but it does not inherently force all client-to-proxy or proxy-to- db connections to be encrypted in the way a DB parameter enforcement does (and you'd still need to ensure clients use TLS). Therefore, enabling the parameter that requires secure transport is the correct solution.
質問 # 58
......
SCS-C03入門知識: https://www.shikenpass.com/SCS-C03-shiken.html
無料でクラウドストレージから最新のShikenPASS SCS-C03 PDFダンプをダウンロードする：https://drive.google.com/open?id=14UKpx4ePxazpsLztmu3sfDDp0jM3kMZS